In today society, a company may depend upon its network to be fully functionally in order to conduct business. To ensure the vitality of the company, the network may have to be protected from external attacks (such as virus attacks, malware attacks, etc.). Accordingly, the network may be monitored to ensure reliable operation, fault detection, timely mitigation of potentially malicious activities and the like. One method for monitoring the network includes the installation of an inline network tap and one or more monitoring systems (such as an intrusion prevention system, an intrusion detection system, a firewall, a packet sniffer, and the like).
To facilitate discussion, FIG. 1A shows a simple diagram of a network environment with a monitoring system, such as an intrusion prevention system (IPS). Consider the situation wherein, for example, a network tap 106 may be employed to gather information about data traffic flowing between two network devices (such as network device 102 and network device 104). In other words, data traffic may flow from network device 102 along a path 108 through network tap 106 (into a port 110 and out of a port 112) along a path 114 to network device 104. In a full-duplex network, network tap 106 may also be configured to monitor data traffic flowing from network device 104 to network device 102 (from port 112 to port 110).
To protect itself, a company may install a monitoring system, such as an intrusion prevention system (IPS) 116. In the aforementioned example, data traffic may flow through IPS 116 before being forwarded onward. In an example, data traffic coming from network device 102 may flow into port 110 then out of a port 120 to IPS 116. Data traffic may then flow from IPS 116 back to network tap 106 via a port 122 before being sent onward along path 114 to network device 104. Similarly, data traffic coming from port 104 may also be flowing though IPS 116 (path includes port 112-port 122-IPS 116-port 120-port 110).
However, malfunction may also occur resulting in the network being unprotected. To ensure that IPS 116 is able to receive and transmit the data traffic, a diagnostic test may be performed to determine the condition of IPS 116. The diagnostic test includes inserting a unique data packet, known as a heartbeat packet, into the network data traffic flowing to IPS 116. IPS 116 is considered to be working properly if the heartbeat packet is received by IPS 116 and sent back to network tap 106 within a predefined period.
Consider the situation wherein, for example, a diagnostic test is being performed to determine the condition of IPS 116. In a typical diagnostic test, the user may define two parameters. The first parameter may be the time interval (e.g., every one second) for sending a heartbeat packet. The second parameter may be the set of fail conditions. In an example, the diagnostic test may be considered to have failed if network tap 106 fails to receive back from IPS 116 three consecutive heartbeat packets. Both of these parameters may be user-configurable and may vary depending upon the network condition and/or network hardware.
To facilitate the discussion, FIG. 1A will be discussed in relation to FIG. 1B, which shows a simple flow chart illustrating a method for performing a diagnostic test.
Before executing the diagnostic test, a counter may be initialized to zero (step 152).
At a next step 154, a heartbeat packet may be inserted into the data traffic and sent from a network tap 106 to an IPS 116 via a port 120.
At a next step 156, the counter may be increased by one. The counter may be increased by one each time a heartbeat packet is sent and the counter may be reset to zero each time the heartbeat packet is received back from IPS 116. In other word, if the heart beat packet is sent back to network tap 106 via a port 122, the counter may be reset to zero.
At a next step 158, the system of network tap 106 performs a parameter check. A parameter check may include checking to see if the predefined time interval has passed. If the time interval has passed, another heartbeat packet may be sent. Another parameter check may include determining if the one of the fail conditions has been met. In this example, one of the fail conditions is three consecutive heartbeat packets not being received back by network tap 106.
At a next step 160, the system makes a determination if a fail condition exists. If a fail condition does not exist, the system returns to step 154 to continue the diagnostic test. However, if a fail condition exists, network tap 106 is switched from a normal mode to a bypass mode and the data traffic is rerouted (step 162). In other words, data traffic is no longer routed through IPS 116.
Although the single heartbeat diagnostic test may provide a method for identify a condition in which the data traffic may not be properly protected, other conditions may exist that may not be identified through the single heartbeat diagnostic test. Thus, companies continue to seek additional measures to ensure reliable operation, fault detection, and/or timely mitigation of potentially malicious activities.